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Thursday, 4 October 2018 


Commissioner Elizabeth Denham 
Information Commissioner 
Information Commissioner’s Office 


By email: childrenandthe GDPR@ICO.org.uk 


Dear Ms Denham, 


| fondly recall meeting you at APEC in Vietnam when | was at Microsoft and you were still the BC 
Commissioner. | was delighted to hear that you had taken on the role as UK Information Commissioner 
and you may know that | now serve as the Australian eSafety Commissioner. The eSafety Office is 
currently the only government office in the world solely dedicated to leading and coordinating online 
safety efforts nationally, and to helping keep its citizens safer online. 


My Office has been paying close attention to recent developments in the United Kingdom and Europe 
in relation to securing a safer online environment for all citizens. We were interested to see the 
Information Commissioner's call for evidence on the Age Appropriate Design Code (the Code) as a 
requirement of the Data Protection Act 2018 (the Act), and felt it opportune to highlight the work that 
my Office is currently engaged in, in relation to Safety-by-Design, given the synergies this proposed 
framework shares with the Code. 


As indicated above, the Office of the eSafety Commissioner (the Office) is the Australian government 
agency responsible for leading, coordinating and advising on online safety issues. As such, the Office 
plays a key role in educating and enabling Australians to combat cyber harm or abuse in all of its 
manifestations, to better manage the safety and wellbeing of Australians online, and to develop critical 
digital skills to ensure Australians feel inspired to explore and engage with the online world whilst also 
having the resilience to overcome online setbacks. 


The Office is acutely aware of the debates unfolding internationally on the demand for industry to create 
safer online platforms and services to meet the needs of children, and all users, in the digital space. 
The specific needs of children and young people in the digital world have often been overlooked. | am 
delighted to see a paradigm shift occurring, where the rights of children and young people are beginning 
to be properly recognised, addressed and promoted in the online world. 


As a long-time proponent of privacy by design and industry accountability, I’m sure you’d agree that 
safety, privacy and security responsibilities should not fall solely upon the end user. These three aspects 
constitute fundamental design principles which ought to be incorporated from the initial stages of 
technology’s developmental processes. These principles are complementary, rather than mutually 
exclusive, and must be balanced with one another by necessity. But safety has tended to lag behind 
the other two disciplines as a recognised product design consideration. 


The Office is currently in the process of developing a Safety-by-Design framework to assist, support 
and harness industry’s responsibility to safeguard its users. This will include a set of high-level principles 
and practical guidance to help technology companies meet best practice, as well as leveraging and 
driving up standards of user-safety within the tech community. The aim of the framework is to encourage 
that safety features are built into the design of platforms and services as they are developed, instead 
of being retrofitted as problems arise. Importantly, it requires that risk assessments are conducted 
before a product is brought to market, to address all known, and anticipated, risks and harms as they 
relate to user-safety. The framework is grounded in children’s rights, set within an ethical and shared 
responsibility framework, and aims to provide a blue-print for organisations by setting out continuous 
and ongoing commitments to drive forward real change. 
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Access to the online world is ubiquitous, and digital platforms and services are accessed by a wide 
representation of the population. Age-appropriate design of services is therefore critical, and the best 
interest of the user should be a primary consideration. The United Nations Convention on the Rights of 
the Child and the rights of children online are imperative and the Code, like the framework, 
acknowledges the importance of incorporating these rights into the development of digital and technical 
tools, services and platforms. An impact assessment in relation to child development in the digital world 
has yet to be conducted, however, we see that an age-appropriate design code could be a valued and 
much-needed step in recognising the importance of addressing the specific needs and provisions of 
children online. 


The importance of developing a shared and consistent narrative globally is essential if we are to make 
greater strides in securing a safer online environment for all citizens. To this end, we are delighted and 
heartened to see the steps being made globally to prioritise the protection of the user within online 
platforms and services. As an Office, we will continue to work alongside other Governments and the 
global community to help shape a digital world that we can all be proud of. The significance of national 
and international collaboration and multi-stakeholder engagement has never been more important to 
address these issues and we will be happy to share with you our Safety-by-Design framework outcomes 
after we have completed the consultation. 


Please do not hesitate to contact the Office should you have any further questions or queries, and we 
wish you all the very best in the development of the Age Appropriate Design Code. 


Yours faithfully, 


Julie Inman Grant 
eSafety Commissioner 
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